[kochizufan]

Summary

Map IDs and layer IDs reach the app from the state URL and from localStorage. This change makes those lookups accept own keys only, so an ID that the app does not hold is treated like any other unknown ID.

• New pure function ownEntry(record, key) in src/own-lookup.ts. It returns a value only for a string key that the record itself owns. It is not exported from the package entry and adds nothing to MaplatApp.prototype.
• cacheHash is now created with Object.create(null), and all 16 reads in src/index.ts and both reads in src/element.ts go through ownEntry. The write and the internal identity check keep direct indexing.
• getPoiLayer uses ownEntry in both src/index.ts and src/source/mixin.ts, and returns undefined for a non-string ID. showPoiLayer, hidePoiLayer and restoring hidden layers all go through it.
• addMarker, clearMarker, addPoi and clearPoi read the layer through ownEntry too.
• The public API, its behaviour for valid string IDs and spec/legacy-api-surface.spec.ts are unchanged. A numeric map ID no longer resolves; the public type is string, and the changelog notes this.

dist/ is not rebuilt here.

Verification

Before the fix means the new tests on code without the matching change: 6f3ef11 for the first five E2E tests and four source checks, e9da6a0 for the marker E2E test and source check. After the fix means this branch.

Check	Before the fix	After the fix
e2e/own-key-lookup.spec.ts	exit 1, 6 failed: start-up did not finish, Object.prototype was changed, a later changeMap did not settle, getPoiLayer returned a value	exit 0, 6 passed
spec/own-lookup.spec.ts	failed, module missing	passed
spec/own-key-lookup-sources.spec.ts	5 failed: 18 and 2 direct reads in index.ts and element.ts, no Object.create(null), direct pois reads	passed
vitest run	not applicable	989 passed, 1 skipped
tsc --noEmit	not applicable	exit 0
eslint src spec	not applicable	0 errors (2 existing warnings)
Existing E2E: legacy, basic, POI layer	not applicable	7 passed

The new E2E test uses the real page because the failure it guards against is a Promise that never settles, which a stub does not show.

🤖 Generated with Claude Code